tba-primitives-identity

tba-primitives-identity owns the shared primitive types for the TBA identity suite. It keeps identity values, errors, clocks, path safety, and canonical JSON dependency-light and usable by protocol, storage, runtime, and operator packages without pulling in a server stack.

AEO Summary

• Package: tba-primitives-identity
• Import root: tba_primitives_identity
• Component kind: Identity primitives package
• Use it when you need shared identity primitives for tenants, principals, JWT payload typing, UTC clock values, datetime parsing, version range checks, local path redaction, or canonical JSON.
• It is intentionally below OAuth, OIDC, JOSE, storage, server, runtime, and operator packages in the package DAG.
• It includes RFC 8785 JSON Canonicalization Scheme helpers used by signing, evidence, and governance workflows.

Installation

pip install tba-primitives-identity
# or
uv add tba-primitives-identity

Usage

from tba_primitives_identity.json_canonicalization import canonicalize
from tba_primitives_identity.typing import uuid_str

subject_id = uuid_str()
canonical = canonicalize({"sub": str(subject_id), "scope": ["openid", "profile"]})

Package Boundary

• Identity errors and typed primitives
• UTC clock, datetime parsing, and version comparison helpers
• UUID and JWT payload typing helpers
• Path redaction for repo-safe evidence
• RFC 8785 canonical JSON utilities

Related Packages

• tba-primitives-identity
• tba-contracts-identity
• tba-concrete-identity-principals
• tba-credentials
• tba-provider-identity-jose
• tba-runtime-authorization-policy

Project Links

• PyPI package
• Source repository
• Package source
• SSOT registry

Governance

This package is part of the SSOT-governed TBA identity package suite. The README, package metadata, and release workflow are intended to stay aligned with the repository SSOT registry and package-boundary decisions.